Load Training Data¶

import pathlib
import sys

sys.path.insert(1, '../')

from sec_sysmon.xml_reader import XMLReader
import plotly.graph_objects as go
import plotly.offline as pyo
from sec_sysmon.rule_classifier import Analyzer

pyo.init_notebook_mode()

# read training data
input_data = [(i, XMLReader(f"../Logs/Train/Person_{i}/Security.xml", f"../Logs/Train/Person_{i}/Sysmon.xml")) for i in range(1, 7)]
analyzer = Analyzer(input_data)

Occurence¶

import json

for attr in analyzer.occurence:
    x = [label for label in analyzer.occurence[attr]]
    y = [analyzer.occurence[attr][label] for label in x]
    bar = go.Bar(name='occurence', x=[f'Person{label}' for label in x], y=y, text=[round(n,2) for n in y], textposition='auto')
    
    print(f"# {attr}")
    print(json.dumps(analyzer.occurence[attr], indent=4))
    
    fig = go.Figure(data=[bar])
    fig.update_layout(xaxis_type='category', title_text=attr, barmode='group')
    fig.show()

# system.EventID
{
    "1": 1.0,
    "2": 1.0,
    "3": 1.0,
    "4": 1.0,
    "5": 1.0,
    "6": 1.0
}

# event_data.ObjectType
{
    "1": 0.0020242914979757085,
    "2": 0,
    "3": 0.902600082542303,
    "4": 0,
    "5": 0.004036908881199538,
    "6": 0.001392757660167131
}

# event_data.TargetProcessId
{
    "1": 0,
    "2": 0.007936507936507936,
    "3": 0,
    "4": 0.049079754601226995,
    "5": 0,
    "6": 0
}

# event_data.Image
{
    "1": 0.8360323886639676,
    "2": 0.8869047619047619,
    "3": 0.07985967808501858,
    "4": 0.4279141104294479,
    "5": 0.5893886966551326,
    "6": 0.9345403899721448
}

# event_data.TargetUserName
{
    "1": 0.0931174089068826,
    "2": 0.041666666666666664,
    "3": 0.01011143210895584,
    "4": 0.05674846625766871,
    "5": 0.1707035755478662,
    "6": 0.01532033426183844
}

# event_data.TargetImage
{
    "1": 0,
    "2": 0.007936507936507936,
    "3": 0,
    "4": 0.049079754601226995,
    "5": 0,
    "6": 0
}

# event_data.NewThreadId
{
    "1": 0,
    "2": 0.007936507936507936,
    "3": 0,
    "4": 0.049079754601226995,
    "5": 0,
    "6": 0
}

# event_data.Hash
{
    "1": 0,
    "2": 0,
    "3": 0.0012381345439537762,
    "4": 0,
    "5": 0.006920415224913495,
    "6": 0
}

# event_data.ParentImage
{
    "1": 0.22469635627530365,
    "2": 0.3492063492063492,
    "3": 0.014857614527445316,
    "4": 0.10276073619631902,
    "5": 0.08823529411764706,
    "6": 0.0947075208913649
}

# event_data.ProviderName
{
    "1": 0,
    "2": 0,
    "3": 0,
    "4": 0.003067484662576687,
    "5": 0.002306805074971165,
    "6": 0
}

Composition¶

for attr in analyzer.statistics:
    bars = []
    if len(analyzer.value_dict[attr]) > 15:
        continue
        
    print(f"\n# {attr}")
    
    for label in analyzer.statistics[attr]:
        print(f"  - Person{label}:")
        print(f"\t{analyzer.statistics[attr][label]}")
              
        x = [n for n in analyzer.statistics[attr][label] if n != None]
        y = [analyzer.statistics[attr][label][n] for n in analyzer.statistics[attr][label] if n != None]
    
        bars.append(go.Bar(name=f'Person{label}', x=x, y=y))
    
    fig = go.Figure(data=bars)
    fig.update_layout(xaxis_type='category', title_text=attr, barmode='group')
    fig.show()

# event_data.ElevatedToken
  - Person1:
	{None: 0.9433198380566802, '%%1842': 0.05465587044534413, '%%1843': 0.0020242914979757085}
  - Person2:
	{None: 0.9682539682539683, '%%1842': 0.031746031746031744, '%%1843': 0.0}
  - Person3:
	{None: 0.9938093272802311, '%%1842': 0.006190672719768881, '%%1843': 0.0}
  - Person4:
	{None: 0.9585889570552147, '%%1842': 0.03987730061349693, '%%1843': 0.0015337423312883436}
  - Person5:
	{None: 0.9769319492502884, '%%1842': 0.02306805074971165, '%%1843': 0.0}
  - Person6:
	{None: 0.9846796657381616, '%%1842': 0.01532033426183844, '%%1843': 0.0}

# event_data.DestinationPortName
  - Person1:
	{None: 0, 'https': 0}
  - Person2:
	{None: 0, 'https': 0}
  - Person3:
	{None: 0, 'https': 0}
  - Person4:
	{None: 0, 'https': 0}
  - Person5:
	{None: 0.9786620530565168, 'https': 0.021337946943483274}
  - Person6:
	{None: 0, 'https': 0}

# event_data.DestinationIsIpv6
  - Person1:
	{None: 0, 'false': 0, 'true': 0}
  - Person2:
	{None: 0, 'false': 0, 'true': 0}
  - Person3:
	{None: 0, 'false': 0, 'true': 0}
  - Person4:
	{None: 0, 'false': 0, 'true': 0}
  - Person5:
	{None: 0.9175317185697809, 'false': 0.021337946943483274, 'true': 0.06113033448673587}
  - Person6:
	{None: 0, 'false': 0, 'true': 0}

# event_data.CallerProcessName
  - Person1:
	{'C:\\Program Files\\LibreOffice\\program\\soffice.bin': 0.0020242914979757085, 'C:\\Program Files (x86)\\Dev-Cpp\\devcpp.exe': 0.0, 'C:\\Windows\\System32\\VSSVC.exe': 0.0, 'C:\\Windows\\explorer.exe': 0.0, 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe': 0.0020242914979757085, None: 0.9817813765182186, 'C:\\Windows\\System32\\svchost.exe': 0.0, 'C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe': 0.012145748987854251, 'C:\\Windows\\System32\\LogonUI.exe': 0.0020242914979757085}
  - Person2:
	{'C:\\Program Files\\LibreOffice\\program\\soffice.bin': 0.0, 'C:\\Program Files (x86)\\Dev-Cpp\\devcpp.exe': 0.003968253968253968, 'C:\\Windows\\System32\\VSSVC.exe': 0.0, 'C:\\Windows\\explorer.exe': 0.0, 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe': 0.003968253968253968, None: 0.9920634920634921, 'C:\\Windows\\System32\\svchost.exe': 0.0, 'C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe': 0.0, 'C:\\Windows\\System32\\LogonUI.exe': 0.0}
  - Person3:
	{'C:\\Program Files\\LibreOffice\\program\\soffice.bin': 0.0, 'C:\\Program Files (x86)\\Dev-Cpp\\devcpp.exe': 0.0, 'C:\\Windows\\System32\\VSSVC.exe': 0.0016508460586050352, 'C:\\Windows\\explorer.exe': 0.0, 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe': 0.0002063557573256294, None: 0.9964919521254643, 'C:\\Windows\\System32\\svchost.exe': 0.0004127115146512588, 'C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe': 0.0012381345439537762, 'C:\\Windows\\System32\\LogonUI.exe': 0.0}
  - Person4:
	{'C:\\Program Files\\LibreOffice\\program\\soffice.bin': 0.0, 'C:\\Program Files (x86)\\Dev-Cpp\\devcpp.exe': 0.0, 'C:\\Windows\\System32\\VSSVC.exe': 0.0, 'C:\\Windows\\explorer.exe': 0.0, 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe': 0.0, None: 0.99079754601227, 'C:\\Windows\\System32\\svchost.exe': 0.0, 'C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe': 0.009202453987730062, 'C:\\Windows\\System32\\LogonUI.exe': 0.0}
  - Person5:
	{'C:\\Program Files\\LibreOffice\\program\\soffice.bin': 0.0, 'C:\\Program Files (x86)\\Dev-Cpp\\devcpp.exe': 0.0, 'C:\\Windows\\System32\\VSSVC.exe': 0.00922722029988466, 'C:\\Windows\\explorer.exe': 0.0005767012687427913, 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe': 0.0028835063437139563, None: 0.9838523644752019, 'C:\\Windows\\System32\\svchost.exe': 0.0, 'C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe': 0.0034602076124567475, 'C:\\Windows\\System32\\LogonUI.exe': 0.0}
  - Person6:
	{'C:\\Program Files\\LibreOffice\\program\\soffice.bin': 0, 'C:\\Program Files (x86)\\Dev-Cpp\\devcpp.exe': 0, 'C:\\Windows\\System32\\VSSVC.exe': 0, 'C:\\Windows\\explorer.exe': 0, 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe': 0, None: 0, 'C:\\Windows\\System32\\svchost.exe': 0, 'C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe': 0, 'C:\\Windows\\System32\\LogonUI.exe': 0}

# event_data.Hash
  - Person1:
	{'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, 'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0, None: 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0}
  - Person2:
	{'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, 'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0, None: 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0}
  - Person3:
	{'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0.0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0.0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0.0, 'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0.0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0.0002063557573256294, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0.0002063557573256294, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0.0002063557573256294, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0.0006190672719768881, None: 0.9987618654560462, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0.0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0.0}
  - Person4:
	{'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, 'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0, None: 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0}
  - Person5:
	{'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0.0005767012687427913, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0.0005767012687427913, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0.0017301038062283738, 'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0.0005767012687427913, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0.0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0.0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0.0011534025374855825, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0.0, None: 0.9930795847750865, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0.0005767012687427913, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0.0017301038062283738}
  - Person6:
	{'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, 'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0, None: 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0}

# event_data.TargetUserName
  - Person1:
	{'NS': 0.022267206477732792, 'WDAGUtilityAccount': 0.0020242914979757085, 'Administrator': 0.004048582995951417, 'DWM-1': 0.0, 'SYSTEM': 0.05263157894736842, 'Backup Operators': 0.0, None: 0.9068825910931174, 'DefaultAccount': 0.0020242914979757085, 'Guest': 0.010121457489878543, 'Administrators': 0.0}
  - Person2:
	{'NS': 0.00992063492063492, 'WDAGUtilityAccount': 0.0, 'Administrator': 0.0, 'DWM-1': 0.0, 'SYSTEM': 0.031746031746031744, 'Backup Operators': 0.0, None: 0.9583333333333334, 'DefaultAccount': 0.0, 'Guest': 0.0, 'Administrators': 0.0}
  - Person3:
	{'NS': 0.0008254230293025176, 'WDAGUtilityAccount': 0.0, 'Administrator': 0.0002063557573256294, 'DWM-1': 0.0, 'SYSTEM': 0.006190672719768881, 'Backup Operators': 0.0010317787866281469, None: 0.9898885678910442, 'DefaultAccount': 0.0, 'Guest': 0.0008254230293025176, 'Administrators': 0.0010317787866281469}
  - Person4:
	{'NS': 0.003067484662576687, 'WDAGUtilityAccount': 0.0, 'Administrator': 0.0015337423312883436, 'DWM-1': 0.007668711656441718, 'SYSTEM': 0.03834355828220859, 'Backup Operators': 0.0, None: 0.9432515337423313, 'DefaultAccount': 0.0, 'Guest': 0.006134969325153374, 'Administrators': 0.0}
  - Person5:
	{'NS': 0.006343713956170703, 'WDAGUtilityAccount': 0.03229527104959631, 'Administrator': 0.0328719723183391, 'DWM-1': 0.0, 'SYSTEM': 0.02306805074971165, 'Backup Operators': 0.00461361014994233, None: 0.8292964244521338, 'DefaultAccount': 0.03229527104959631, 'Guest': 0.03460207612456748, 'Administrators': 0.00461361014994233}
  - Person6:
	{'NS': 0.0, 'WDAGUtilityAccount': 0.0, 'Administrator': 0.0, 'DWM-1': 0.0, 'SYSTEM': 0.01532033426183844, 'Backup Operators': 0.0, None: 0.9846796657381616, 'DefaultAccount': 0.0, 'Guest': 0.0, 'Administrators': 0.0}

# event_data.TargetDomainName
  - Person1:
	{'DESKTOP-P84STH6': 0.04048582995951417, 'Builtin': 0.0, None: 0.9068825910931174, 'Window Manager': 0.0, 'NT AUTHORITY': 0.05263157894736842}
  - Person2:
	{'DESKTOP-P84STH6': 0.00992063492063492, 'Builtin': 0.0, None: 0.9583333333333334, 'Window Manager': 0.0, 'NT AUTHORITY': 0.031746031746031744}
  - Person3:
	{'DESKTOP-P84STH6': 0.0018572018159306646, 'Builtin': 0.0020635575732562937, None: 0.9898885678910442, 'Window Manager': 0.0, 'NT AUTHORITY': 0.006190672719768881}
  - Person4:
	{'DESKTOP-P84STH6': 0.010736196319018405, 'Builtin': 0.0, None: 0.9432515337423313, 'Window Manager': 0.007668711656441718, 'NT AUTHORITY': 0.03834355828220859}
  - Person5:
	{'DESKTOP-P84STH6': 0.1384083044982699, 'Builtin': 0.00922722029988466, None: 0.8292964244521338, 'Window Manager': 0.0, 'NT AUTHORITY': 0.02306805074971165}
  - Person6:
	{'DESKTOP-P84STH6': 0.0, 'Builtin': 0.0, None: 0.9846796657381616, 'Window Manager': 0.0, 'NT AUTHORITY': 0.01532033426183844}

# event_data.LogonProcessName
  - Person1:
	{None: 0.9412955465587044, 'Advapi\n\t\t\t': 0.05465587044534413, 'Advapi  ': 0.0, 'User32\n\t\t\t': 0.004048582995951417}
  - Person2:
	{None: 0.9662698412698413, 'Advapi\n\t\t\t': 0.03373015873015873, 'Advapi  ': 0.0, 'User32\n\t\t\t': 0.0}
  - Person3:
	{None: 0.9936029715229054, 'Advapi\n\t\t\t': 0.0, 'Advapi  ': 0.0063970284770945105, 'User32\n\t\t\t': 0.0}
  - Person4:
	{None: 0.9585889570552147, 'Advapi\n\t\t\t': 0.04141104294478527, 'Advapi  ': 0.0, 'User32\n\t\t\t': 0.0}
  - Person5:
	{None: 0.97520184544406, 'Advapi\n\t\t\t': 0.0, 'Advapi  ': 0.024798154555940023, 'User32\n\t\t\t': 0.0}
  - Person6:
	{None: 0.9846796657381616, 'Advapi\n\t\t\t': 0.0, 'Advapi  ': 0.01532033426183844, 'User32\n\t\t\t': 0.0}

# event_data.TargetUserSid
  - Person1:
	{'S-1-5-18': 0.05263157894736842, 'S-1-5-90-0-1': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.008097165991902834, 'S-1-0-0': 0.0020242914979757085, None: 0.937246963562753}
  - Person2:
	{'S-1-5-18': 0.031746031746031744, 'S-1-5-90-0-1': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.0, 'S-1-0-0': 0.001984126984126984, None: 0.9662698412698413}
  - Person3:
	{'S-1-5-18': 0.006190672719768881, 'S-1-5-90-0-1': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.0, 'S-1-0-0': 0.0002063557573256294, None: 0.9936029715229054}
  - Person4:
	{'S-1-5-18': 0.03834355828220859, 'S-1-5-90-0-1': 0.006134969325153374, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.0, 'S-1-0-0': 0.0, None: 0.9555214723926381}
  - Person5:
	{'S-1-5-18': 0.02306805074971165, 'S-1-5-90-0-1': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.0, 'S-1-0-0': 0.0017301038062283738, None: 0.97520184544406}
  - Person6:
	{'S-1-5-18': 0.01532033426183844, 'S-1-5-90-0-1': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.0, 'S-1-0-0': 0.0, None: 0.9846796657381616}

# event_data.TargetSid
  - Person1:
	{'S-1-5-32-551': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.010121457489878543, 'S-1-5-32-544': 0.0, None: 0.9817813765182186, 'S-1-5-21-223836497-1760142647-788189203-501': 0.008097165991902834}
  - Person2:
	{'S-1-5-32-551': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.007936507936507936, 'S-1-5-32-544': 0.0, None: 0.9920634920634921, 'S-1-5-21-223836497-1760142647-788189203-501': 0.0}
  - Person3:
	{'S-1-5-32-551': 0.0010317787866281469, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.0006190672719768881, 'S-1-5-32-544': 0.0010317787866281469, None: 0.9964919521254643, 'S-1-5-21-223836497-1760142647-788189203-501': 0.0008254230293025176}
  - Person4:
	{'S-1-5-32-551': 0.0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.003067484662576687, 'S-1-5-32-544': 0.0, None: 0.99079754601227, 'S-1-5-21-223836497-1760142647-788189203-501': 0.006134969325153374}
  - Person5:
	{'S-1-5-32-551': 0.00461361014994233, 'S-1-5-21-223836497-1760142647-788189203-1001': 0.00461361014994233, 'S-1-5-32-544': 0.00461361014994233, None: 0.9838523644752019, 'S-1-5-21-223836497-1760142647-788189203-501': 0.002306805074971165}
  - Person6:
	{'S-1-5-32-551': 0, 'S-1-5-21-223836497-1760142647-788189203-1001': 0, 'S-1-5-32-544': 0, None: 0, 'S-1-5-21-223836497-1760142647-788189203-501': 0}